CVE-2025-71390High· 8.8▾ TwilightSurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>)…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
— → 8.8
none → high
0.2% → 0.5%
SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.
surrealdb < 2.1.8surrealdb >= 2.2.0, < 2.2.6surrealdb >= 2.3.0, < 2.3.6surrealdb = 3.0.0Upgrade past the affected range:
surrealdb 2.3.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109336Medium· 4.3SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections
CVE-2026-63751Medium· 4.3SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch
CVE-2026-63755Medium· 6.5SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
GHSA-8rw6-p7m8-63jpMedium· 6.5SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
GHSA-fpxg-5xmv-922mMedium· 4.3SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
GHSA-6wqw-vhfr-9999Medium· 4.3SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions